Problem
sensitive: true strips a field on the generated PERSONAL surface. There is no role-scoped equivalent on the main surface: a salary/rate/margin field is visible to every user with access to the entity. Hiding it in the UI alone would be cosmetic security — the REST response still carries the value.
Ask
A field-level hiddenFor: [role] (or inverse visibleTo:), enforced in the generated REST serialization: the field is stripped from responses and ignored on writes unless the caller holds the role; the generated UI hides the column/input consistently. Same server-side allow-list principle as the personal surface's sensitive: handling.
Problem
sensitive: truestrips a field on the generated PERSONAL surface. There is no role-scoped equivalent on the main surface: a salary/rate/margin field is visible to every user with access to the entity. Hiding it in the UI alone would be cosmetic security — the REST response still carries the value.Ask
A field-level
hiddenFor: [role](or inversevisibleTo:), enforced in the generated REST serialization: the field is stripped from responses and ignored on writes unless the caller holds the role; the generated UI hides the column/input consistently. Same server-side allow-list principle as the personal surface'ssensitive:handling.